CVE-2026-49430: Kernel heap overflow in ZFS_IOC_RECV_NEW ioctl
The ZFSIOCRECVNEW ioctl, in the heal receive path, similarly truncated a 64-bit payload size to a 32-bit integer for allocation, then used the original 64-bit size as the length for a byteswap operation.
A local user with the "receive" delegated ZFS permission can trigger kernel memory corruption via ZFSIOCRECVNEW by sending a crafted receive stream in heal mode.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems using OpenZFS ZFS are exposed where a local user has been granted the delegated ZFS "receive" permission. Exploitation requires that user to invoke ZFS_IOC_RECV_NEW with a crafted receive stream in heal mode.
Does an attacker need existing local access or ZFS privileges?
Yes. The described attack is local and requires the delegated ZFS "receive" permission; the provided information does not indicate exploitation by an unprivileged remote attacker.
What condition makes the crafted input trigger memory corruption?
The vulnerable heal receive path truncates a 64-bit payload size to 32 bits when allocating memory, then uses the original 64-bit value for a byteswap operation. A crafted receive stream can therefore cause the byteswap length to exceed the allocated buffer.